feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

server/web/src/api/client.ts

@@ -4,9 +4,14 @@ import { authHeaders } from './auth';
 const API_BASE = '/api/v1';
 
 async function fetchJSON<T>(url: string, options?: RequestInit): Promise<T> {
+  const { headers: extraHeaders, ...rest } = options ?? {};
   const res = await fetch(`${API_BASE}${url}`, {
-    headers: { 'Content-Type': 'application/json', ...authHeaders(), ...(options?.headers as Record<string, string>) },
-    ...options,
+    ...rest,
+    headers: {
+      'Content-Type': 'application/json',
+      ...authHeaders(),
+      ...(extraHeaders as Record<string, string> | undefined),
+    },
   });
   if (!res.ok) {
     const err = await res.text();